How a Global Top 10 Bank scaled to producing over 5,000 automated threat models

Threat model at scale

The objective of the global bank was to migrate the threat modeling activity from security architects, in the central risk team, to the solution architects in the engineering teams. As a Global Systemically Important Bank (G-SIB) with over 200,000 employees and presence across the globe, the Bank needed an automated and scalable solution.

Key challenges

The bank’s Security Architects were already performing threat modeling manually but they wanted to increase the repeatability, consistency, and breadth of these models.The Bank had identified that some components and risk patterns for its applications were being missed by this manual approach and that there were gaps in what was covered, including user journey and business logic threats.

Solution

The bank evaluated IriusRisk alongside other threat modeling tools as part of a competitive procurement process. IriusRisk’s SaaS approach meant that the solution integrated well with the bank’s architecture and it was impressed with the platform’s API and customizable content and rules, which immediately enabled the automation of threat modeling processes, making it possible to undertake more threat models at scale.

One of the stand-out features that led to the bank choosing IriusRisk was its flexible framework which enabled teams to make use of both the comprehensive library of threat models builtin to the IriusRisk platform, and augment these with their own organization-specific threats, counter measures and architectural security rules. This meant that the bank could customize threat models to its own solutions so that engineers implement security controls approved by the bank and by the central security team.

Results

With IriusRisk, the bank has managed to make its threat modeling process more efficient, comprehensive and reliable. It has increased the number of threat models it runs across its product portfolio and removed the bottleneck of the central security team, by putting threat modeling in the hands of engineering. This is thanks to automation relieving the manual burden on security professionals and enabling the solution architects to take on a more active security role. IriusRisk’s comprehensive security standards and compliance libraries have also helped to increase the consistency of threat models and ensured that key risk patterns are covered during the threat modeling process.

As a consequence, the bank has been able to get solution architects to buy into the threat modeling process, inputting architecture details into the IriusRisk platform directly. The bank is now looking to increase the use of “self-service” threat models by solution architects to put security into the hands of the engineering teams. With a base level of consistency in threat modeling, the bank is also exploring how it can integrate the IriusRisk platform with penetration testing, automated scanning and the configuration compliance service to create a holistic view of the security posture of its applications.